finished security re-write, wrote query